|
 |
11f80c |
From 2bbdfd76dab187ab29e22bed18d737f94343e629 Mon Sep 17 00:00:00 2001
|
|
|
11f80c |
From: Tomas Hozza <thozza@redhat.com>
|
|
|
11f80c |
Date: Tue, 4 Sep 2018 11:22:14 +0200
|
|
|
11f80c |
Subject: [PATCH] Add TLS 1.3 support for GnuTLS
|
|
|
11f80c |
|
|
|
11f80c |
* doc/wget.texi: Add "TLSv1_3" to --secure-protocol
|
|
|
11f80c |
* src/gnutls.c (set_prio_default): Use GNUTLS_TLS1_3 where needed
|
|
|
11f80c |
|
|
|
11f80c |
Wget currently allows specifying "TLSv1_3" as the parameter for
|
|
|
11f80c |
--secure-protocol option. However it is only implemented for OpenSSL
|
|
|
11f80c |
and in case wget is compiled with GnuTLS, it causes wget to abort with:
|
|
|
11f80c |
GnuTLS: unimplemented 'secure-protocol' option value 6
|
|
|
11f80c |
|
|
|
11f80c |
GnuTLS contains TLS 1.3 implementation since version 3.6.3 [1]. However
|
|
|
11f80c |
currently it must be enabled explicitly in the application of it to be
|
|
|
11f80c |
used. This will change after the draft is finalized. [2] However for
|
|
|
11f80c |
the time being, I enabled it explicitly in case "TLSv1_3" is used with
|
|
|
11f80c |
--secure-protocol.
|
|
|
11f80c |
|
|
|
11f80c |
I also fixed man page to contain "TLSv1_3" in all listings of available
|
|
|
11f80c |
parameters for --secure-protocol
|
|
|
11f80c |
|
|
|
11f80c |
[1] https://lists.gnupg.org/pipermail/gnutls-devel/2018-July/008584.html
|
|
|
11f80c |
[2] https://nikmav.blogspot.com/2018/05/gnutls-and-tls-13.html
|
|
|
11f80c |
|
|
|
11f80c |
Signed-off-by: Tomas Hozza <thozza@redhat.com>
|
|
|
11f80c |
---
|
|
|
11f80c |
doc/wget.texi | 6 +++---
|
|
|
11f80c |
src/gnutls.c | 28 ++++++++++++++++++++++++++++
|
|
|
11f80c |
2 files changed, 31 insertions(+), 3 deletions(-)
|
|
|
11f80c |
|
|
|
11f80c |
diff --git a/doc/wget.texi b/doc/wget.texi
|
|
|
11f80c |
index 38b4a245..7ae19d8e 100644
|
|
|
11f80c |
--- a/doc/wget.texi
|
|
|
11f80c |
+++ b/doc/wget.texi
|
|
|
11f80c |
@@ -1780,9 +1780,9 @@ If Wget is compiled without SSL support, none of these options are available.
|
|
|
11f80c |
@cindex SSL protocol, choose
|
|
|
11f80c |
@item --secure-protocol=@var{protocol}
|
|
|
11f80c |
Choose the secure protocol to be used. Legal values are @samp{auto},
|
|
|
11f80c |
-@samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1}, @samp{TLSv1_1}, @samp{TLSv1_2}
|
|
|
11f80c |
-and @samp{PFS}. If @samp{auto} is used, the SSL library is given the
|
|
|
11f80c |
-liberty of choosing the appropriate protocol automatically, which is
|
|
|
11f80c |
+@samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1}, @samp{TLSv1_1}, @samp{TLSv1_2},
|
|
|
11f80c |
+@samp{TLSv1_3} and @samp{PFS}. If @samp{auto} is used, the SSL library is
|
|
|
11f80c |
+given the liberty of choosing the appropriate protocol automatically, which is
|
|
|
11f80c |
achieved by sending a TLSv1 greeting. This is the default.
|
|
|
11f80c |
|
|
|
11f80c |
Specifying @samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1}, @samp{TLSv1_1},
|
|
|
11f80c |
diff --git a/src/gnutls.c b/src/gnutls.c
|
|
|
11f80c |
index 07844c52..206d0b09 100644
|
|
|
11f80c |
--- a/src/gnutls.c
|
|
|
11f80c |
+++ b/src/gnutls.c
|
|
|
11f80c |
@@ -565,6 +565,15 @@ set_prio_default (gnutls_session_t session)
|
|
|
11f80c |
err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1", NULL);
|
|
|
11f80c |
break;
|
|
|
11f80c |
|
|
|
11f80c |
+ case secure_protocol_tlsv1_3:
|
|
|
11f80c |
+#if GNUTLS_VERSION_NUMBER >= 0x030603
|
|
|
11f80c |
+ err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0:+VERS-TLS1.3:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-TLS1.2", NULL);
|
|
|
11f80c |
+ break;
|
|
|
11f80c |
+#else
|
|
|
11f80c |
+ logprintf (LOG_NOTQUIET, _("Your GnuTLS version is too old to support TLS 1.3\n"));
|
|
|
11f80c |
+ return -1;
|
|
|
11f80c |
+#endif
|
|
|
11f80c |
+
|
|
|
11f80c |
case secure_protocol_pfs:
|
|
|
11f80c |
err = gnutls_priority_set_direct (session, "PFS:-VERS-SSL3.0", NULL);
|
|
|
11f80c |
if (err != GNUTLS_E_SUCCESS)
|
|
|
11f80c |
@@ -596,19 +605,38 @@ set_prio_default (gnutls_session_t session)
|
|
|
11f80c |
allowed_protocols[0] = GNUTLS_TLS1_0;
|
|
|
11f80c |
allowed_protocols[1] = GNUTLS_TLS1_1;
|
|
|
11f80c |
allowed_protocols[2] = GNUTLS_TLS1_2;
|
|
|
11f80c |
+#if GNUTLS_VERSION_NUMBER >= 0x030603
|
|
|
11f80c |
+ allowed_protocols[3] = GNUTLS_TLS1_3;
|
|
|
11f80c |
+#endif
|
|
|
11f80c |
err = gnutls_protocol_set_priority (session, allowed_protocols);
|
|
|
11f80c |
break;
|
|
|
11f80c |
|
|
|
11f80c |
case secure_protocol_tlsv1_1:
|
|
|
11f80c |
allowed_protocols[0] = GNUTLS_TLS1_1;
|
|
|
11f80c |
allowed_protocols[1] = GNUTLS_TLS1_2;
|
|
|
11f80c |
+#if GNUTLS_VERSION_NUMBER >= 0x030603
|
|
|
11f80c |
+ allowed_protocols[2] = GNUTLS_TLS1_3;
|
|
|
11f80c |
+#endif
|
|
|
11f80c |
err = gnutls_protocol_set_priority (session, allowed_protocols);
|
|
|
11f80c |
break;
|
|
|
11f80c |
|
|
|
11f80c |
case secure_protocol_tlsv1_2:
|
|
|
11f80c |
allowed_protocols[0] = GNUTLS_TLS1_2;
|
|
|
11f80c |
+#if GNUTLS_VERSION_NUMBER >= 0x030603
|
|
|
11f80c |
+ allowed_protocols[1] = GNUTLS_TLS1_3;
|
|
|
11f80c |
+#endif
|
|
|
11f80c |
+ err = gnutls_protocol_set_priority (session, allowed_protocols);
|
|
|
11f80c |
+ break;
|
|
|
11f80c |
+
|
|
|
11f80c |
+ case secure_protocol_tlsv1_3:
|
|
|
11f80c |
+#if GNUTLS_VERSION_NUMBER >= 0x030603
|
|
|
11f80c |
+ allowed_protocols[0] = GNUTLS_TLS1_3;
|
|
|
11f80c |
err = gnutls_protocol_set_priority (session, allowed_protocols);
|
|
|
11f80c |
break;
|
|
|
11f80c |
+#else
|
|
|
11f80c |
+ logprintf (LOG_NOTQUIET, _("Your GnuTLS version is too old to support TLS 1.3\n"));
|
|
|
11f80c |
+ return -1;
|
|
|
11f80c |
+#endif
|
|
|
11f80c |
|
|
|
11f80c |
default:
|
|
|
11f80c |
logprintf (LOG_NOTQUIET, _("GnuTLS: unimplemented 'secure-protocol' option value %d\n"), opt.secure_protocol);
|
|
|
11f80c |
--
|
|
|
11f80c |
2.17.1
|
|
|
11f80c |
|